https://community.splunk.com/t5/Splunk-Search/Combining-Two-Fields-For-Searching/m-p/55775#M13620 <P>Your eval statement is fine. You need to fix the stats count. This should do it.</P> <P>. | eval newField= query." ".q | stats count(newField)</P> <P>Then you could do | stats count(newField) by newField</P> Fri, 18 May 2012 20:34:09 GMT sdaniels 2012-05-18T20:34:09Z https://community.splunk.com/t5/Splunk-Search/Combining-Two-Fields-For-Searching/m-p/55774#M13619 <P>So I'm trying to run a search in Splunk and have two fields combined to return one larger field. My basic search is:</P> <P>(host="web01.inno-360.com" AND source="/var/log/apache2/basf_ssl_access.log" AND "/profile-services/talent") OR (host="zakta01.inno-360.com" AND basf-landscaping.inno-360.com AND "GET /search" AND query=*)</P> <P>From that I'm interested in two fields: 1) 'query' 2) 'q'. I would like to combine these two fields to end with something like:</P> <P>... | stats count by newField</P> <P>From searching I have tried using eval like this:</P> <P>... | eval newField= query." ".q | stats count by newField</P> <P>However I've had absolutely no luck at all with this. Any help with this would be greatly appreciated.</P> Mon, 28 Sep 2020 11:50:43 GMT https://community.splunk.com/t5/Splunk-Search/Combining-Two-Fields-For-Searching/m-p/55774#M13619 henryt1 2020-09-28T11:50:43Z https://community.splunk.com/t5/Splunk-Search/Combining-Two-Fields-For-Searching/m-p/55775#M13620 <P>Your eval statement is fine. You need to fix the stats count. This should do it.</P> <P>. | eval newField= query." ".q | stats count(newField)</P> <P>Then you could do | stats count(newField) by newField</P> Fri, 18 May 2012 20:34:09 GMT https://community.splunk.com/t5/Splunk-Search/Combining-Two-Fields-For-Searching/m-p/55775#M13620 sdaniels 2012-05-18T20:34:09Z